REMARKS/ARGUMENTS 

This paper is being provided in response to the Office Action dated April 21 , 2005 for the 
above-referenced application. 

The rejection of Claims 1-7, 22-28 and 41-52 under 35 U.S.C. § 103(a) as being 
unpatentable over Waldin et al (U.S. Patent No. 6,094,731 hereinafter referred to as "Waldin") in 
view of Stang (Ph.D, Products to detect changes to programs, 1991, hereinafter referred to as 
"Stang") is hereby traversed and reconsideration thereof is respectfully requested. Applicant 
respectfully submits that Claims 1-7, 22-28 and 41-52 are patentable over the cited references. 

Claim 1 recites a method of scanning a storage device for viruses, comprising: 
determining physical portions of the storage device that have been modified since a previous 
virus scan using information about the physical portions without using information about a file 
structure, a file system, or a file type; and scanning at least parts of the physical portions for 
viruses, wherein scanning is performed without using information about a file structure, a file 
system, or a file type. Claims 2-7 depend from Claim 1 . 

Claim 22 recites a computer program product for scanning a storage device for viruses, 
comprising: means for determining physical portions of the storage device that have been 
modified since a previous virus scan using information about the physical portions without using 
information about a file structure, a file system, or a file type; and means for scanning at least 
parts of the physical portions for viruses, wherein the scanning is performed without using 
information about a file structure, a file system, or a file type. Claims 23-28 depend from Claim 
22. 
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Claims 41 recites an antivirus unit, comprising: means for coupling to at least one storage 
device; means for determining physical portions of the storage device that have been modified 
since a previous virus scan using information about the physical portions without using 
information about a file structure, a file system, or a file type; and means for scanning at least 
parts of the physical portions for viruses, wherein scanning is performed without using 
information about a file structure, a file system, or a file type. Claims 42-52 depend from Claim 
41. 

Waldin discloses a system, method and computer readable medium for examining a file 
associated with an originating computer to determine whether a virus is present within the file. 
(See Abstract). Waldin discloses scanning a file and placing into a critical sectors file the 
identification number of each sector that is scanned. As each sector is operated upon, a hash 
value is calculated for that sector and inserted into the critical sectors file along with the size of 
the file scanned. (Col. 4, Lines 52-64; Figures 1 and 2). Waldin discloses determining hash 
values for only those sectors of a file actually retrieved by module 5 of Figure 1. Module 3 of 
Waldin' s Figure 1 always scans the same set of sectors of a file unless the file changes in length 
or the contents of those sectors changes in some way. The antivirus accelerator module 5 
automatically hashes all sectors scanned by module 3 in the same way regardless of contents of 
the sectors. No new parser of hasher coding needs to be performed and incorporated into module 
5 to support new file formats. (Col. 7, Line 35-Col. 8, Line 2). 

Stang is directed to a review of checksum or CRC comparison programs that may be used 
to detect changes to a program. Stang discloses that each file has a unique fingerprint in the form 
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of a checksum or CRC. (See Page 1). Stang discloses using a change-detection program to 
detect viruses, detecting lost files caused by computer hardware and software problems, and 
detecting use of software that is not "authorized". (See Page 2, bottom, bullet items). Stang 
includes a section entitled EFFICIENCY IN CHECKING ALL FILES (page 14). Checkup is 
disclosed as processing everything on a hard disk. There is no upper limit on the number of files 
that can be scanned. Stang discloses that the Checkup program receives a "0" for accuracy 
because Checkup incorrectly identifies files that have changed when they actually have not. This 
occurs because Checkup creates one X.XUP for every file beginning with X. Thus, the signature 
for X.BAT is stored in X.XUP and the signatures for X.COM, X.SYS, X.BAK, etc., are 
compared with the contents of this file. (Page 1 5). 

Claim 1 is neither disclosed nor suggested by the references, taken separately or in 
combination, in that the references neither disclose nor suggest at least the features of a method 
of scanning a storage device for viruses, comprising: determining physical portions of the 
storage device that have been modified ... without using information about a file structure, a 
file system, or a file type; and scanning ... wherein scanning is performed without using 
information about a file structure, a file system, or a file type, as set forth in Claim 1 . Waldin 
discloses operating on files and uses information about files. For example, Waldin discloses 
using the size of a file (see step 57, Figure 5), and scanning sectors of a file (see, for example, 
element 1, Figure 1; step 22 of Figures 2 and 4). In order to operate on files as disclosed in 
Waldin, information about the file is used by Waldin. As an example, in order for Waldin to scan 
a file, the storage locations associated with the file are needed. Without the storage location as 
may be obtained, for example, using file system information, Waldin could not even determine 
what data to scan. 
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Page 3 of the Office Action cites Stang as support for teaching a method of scanning a 
storage device for viruses including performing scanning without using information about a file 
structure, a file system or a file type. The Office Action cites page 15 of Stang regarding 
Checkup as support for disclosing the foregoing. The description related to the Checkup 
program on page 15 of Stang is included in a section entitled EFFICIENCY IN CHECKING 
ALL FILES (see page 14). The Checkup program processes "everything" on the hard disk rather 
than allow for selective processing such as, for example, by specifying files in an input list. The 
Checkup program as disclosed in Stang operates on all files on a hard disk and identifies when 
files have been changed. In fact, Stang discloses more specifically that file signatures are stored 
and compared to determine changes in file contents at different points in time. The Checkup 
program as disclosed in Stang may scan an entire hard disk, but operates on files by determining 
and comparing file signatures. Thus, the Checkup program as disclosed in Stang operates on 
files and uses information about files in order to determine what is scanned. For example, in 
order to determine a signature for a file, the Checkup program of Stang must know information 
about that file such as, for example, its location. 

Applicant respectfully submits that both Waldin and Stang teach away from Applicant's 
claimed invention. Both Waldin and Stang operate on files and need information about files, 
such as information about a file structure, a file system or a file type. This is in contrast to 
Applicants' claimed invention, as set forth in Claim 1, which recites that determining which 
physical portions of a storage device have been modified and scanning are performed without 
using information about a file structure, a file system or a file type. 
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In view of the foregoing, Applicant respectfully submits that the references do not teach, 
disclose or suggest at least the foregoing recited features of Claim 1. 

For reasons similar to those set forth regarding Claim 1, Claim 22 is neither disclosed nor 
suggested by the references, taken separately or in combination, in that the references neither 
disclose nor suggest a computer program product for scanning a storage device for viruses, 
comprising: means for determining physical portions of the storage device that have been 
modified since a previous virus scan using information about the physical portions without 
using information about a file structure, a file system, or a file type; and means for scanning 
at least parts of the physical portions for viruses, wherein the scanning is performed without 
using information about a file structure, a file system, or a file type, as set forth in Claim 22. 

For reasons similar to those set forth regarding Claim 1, Claim 41 is neither disclosed nor 
suggested by the references, taken separately or in combination, in that the references neither 
disclose nor suggest an antivirus unit, comprising: means for coupling to at least one storage 
device; means for determining physical portions of the storage device that have been modified 
since a previous virus scan using information about the physical portions without using 
information about a file structure, a file system, or a file type; and means for scanning at 
least parts of the physical portions for viruses, wherein scanning is performed without using 
information about a file structure, a file system, or a file type, as set forth in Claim 41 . 
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In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 



Based on the above, Applicant respectfully requests that the Examiner reconsider and 
withdraw all outstanding rejections and objections. Favorable consideration and allowance are 
earnestly solicited. Should there be any questions after reviewing this paper, the Examiner is 
invited to contact the undersigned at 617-248-4042. 
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